Extracted

• • Target

    JaffaCakes118_8f72c551fced833a3116a0725f5fe2a9

  • Size

    307KB

  • MD5

    8f72c551fced833a3116a0725f5fe2a9

  • SHA1

    bb90432f9636d407fdf1465eef07153e522cb23c

  • SHA256

    60150d664a43b1c4f26016308c7aa90965f744c1319fafaa8cfa716ad6c08ef1

  • SHA512

    4635b6b33b9de1117ede7ad541f2588fad4c03a930271f9650bde9c7285f486519e75c37c3abb879bcb30387bb2483f076a8280b1e3b5f92eacf2b7ba05abe8f

  • SSDEEP

    6144:THB4nDso3Z5+cT0noSkRvGJomc5lolmYKhhZy+ot52zWbzlBeKWai61n0AhmA7w4:N4nDso3D70noSM9l4lmYKdzWbJBmapuC

  Score

  10^/10

  cybergatetestdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2